#1503 fix(hma): pin meta hma image by digest and fix create-react-app link

Context & Requests for Reviewers

When meta renamed the github repos, the react stuff went to github.com/react instead of github.com/meta.

Also, pin the HMA image by (multi-platform hash) digest so we're not vulnerable to malicious actors taking over old repo names.

Tests

• docker compose build hma && docker compose up hma starts and runs w/o errors
• https://github.com/react/create-react-app/pull/8227 works

Checklist

Only check items that apply to this PR; leave the rest unchecked.

• If you changed anything user-facing (i.e. user interface or APIs):
  Did you update related docs?

• If the change is notable (refer to Keep a Changelog conventions):
  Did you update CHANGELOG.md?

• If you changed db/src/scripts/** and used CREATE TABLE, ADD COLUMN, or ALTER COLUMN:
  Are as many columns marked NOT NULL as possible? If some columns can sometimes be null depending on other columns, are there CHECK constraints capturing those relationships, and are these also reflected using unions in the associated Kysely types?

• If you added a new signal in server/services/signalsService/signals/**:
  Did you classify every error case as a permanent error (SignalPermanentError, no retry) or a normal error (retryable)? Any case where the signal can't determine a score should be a SignalPermanentError.